How the Attack works The attacker sends fake ARP replies to both the victim and the router. The victim believes the attacker is the router and sends traffic to it. The attacker can intercept, modify, or drop packets.